FSB Notification and FSTEC Rules for Importing High-Tech Medical Devices into Russia in 2025-2026
An MRI scanner is stuck at customs. The registration certificate has been obtained, the declaration of conformity is in order, and the Technical Regulations of the Customs Union (TR TS) documentation is complete. Yet the cargo has not been released for two weeks. The customs inspector cites the absence of an FSB notification. The importer is hearing this term for the very first time.
This situation recurs dozens of times a year, and the cause is always the same: the regulatory architecture imposes requirements from multiple agencies simultaneously on a single product. The Ministry of Health and Roszdravnadzor (Federal Service for Surveillance in Healthcare) treat an MRI scanner as a medical device (MD) and require a registration certificate. The FSB (Federal Security Service) sees the same device as a cryptographic tool, because image transmission between departments runs over an encrypted channel. FSTEC (Federal Service for Technical and Export Control) reviews the component base from an export-control perspective. Each agency is right, and each requires its own document.
This situation is well captured by the matryoshka doll metaphor. The outermost layer — MD registration with Roszdravnadzor — is familiar to every market participant. But two more layers are hidden inside, and they are precisely the ones that most often cause delays, fines, and confiscations.
Why Medical Technology Came Under FSB Oversight
Twenty years ago, medical equipment ran primarily on analog circuits. Images were transmitted by cable, stored on film, and network connectivity did not exist.
Today, a high-end ultrasound machine is technically closer to a server than to any Soviet-era medical instrument: Linux on board, a Wi-Fi module, HTTPS support, a built-in SSD with hardware encryption, and integration with a PACS system over an encrypted protocol. An MRI scanner transmits DICOM files to the cloud. A robotic surgical system is controlled via a secure communication channel. Intensive care monitors synchronize with the nursing station over WPA3. Encryption is no longer optional — it is built into the device itself, and that is precisely what brings medical technology under FSB regulation.
The legal basis is established in Decision of the Collegium of the Eurasian Economic Commission (EEC) dated April 21, 2015, No. 30 «On Non-Tariff Regulation Measures» (hereinafter — Decision No. 30), Annex 2.19. Any device with cryptographic (encryption) functions requires a notification upon import into the Eurasian Economic Union (EAEU). A notification is an advisory document registered by the Center for Licensing, Certification, and Protection of State Secrets of the FSB of Russia (hereinafter — CLSZ FSB). Classification is based on two criteria together: the EAEU Harmonized System (HS) code and the functional characteristics of the device. An ultrasound machine under HS code 9018 90 falls within Annex 2.19 not because medical equipment appears there as a separate line, but because the device encrypts information.
As of September 28, 2025, the registration procedure changed: information about spare parts is no longer included in notifications. Notifications issued before that date that contained spare-part information remain valid until their expiration.
What Specifically Triggers a Notification Requirement
If the technical documentation for a device contains even one of the following features, a notification is required:
Wi-Fi (WPA/WPA2/WPA3 protocols
Bluetooth with encryption
HTTPS, SSL/TLS support
AES, RSA, GOST 28147-89, or any other cryptographic algorithm
Hardware drive encryption (Self-Encrypting Drive, BitLocker, or equivalent)
VPN or secure remote-access capability
The notification must be filed by the manufacturer or its authorized representative — a Russian distributor cannot do this independently. The document is registered with the CLSZ FSB: review takes up to 10 working days, after which the data is transmitted to the EEC. The notification appears in the EEC registry within 3 additional working days. Customs officers check against that registry. A printed document bearing an FSB stamp does not, by itself, release a shipment — what matters is that the notification is already recorded in the registry.
From application submission to customs clearance, the practical timeline is 3 to 4 weeks. Plan your logistics with this buffer built in.
The Second Layer: FSTEC and Dual-Use Goods
For import customs clearance, an FSB notification is sufficient. For certain categories of medical technology, however, a further check exists — from FSTEC of Russia.
FSTEC controls dual-use goods: products manufactured for civilian purposes that can also be used in the development of weapons or military equipment. The legal framework is Federal Law No. 183-FZ dated July 18, 1999 «On Export Control» (hereinafter — Federal Law No. 183) and Government Decree No. 1299 dated July 19, 2022, which approves the list of controlled goods (hereinafter — GD No. 1299).
In the medical segment, several scenarios are relevant. Tomographs that use isotopes (PET scanners, gamma cameras) contain sources of ionizing radiation. Particle accelerators used in radiation therapy are structurally related to military systems. High-precision laser systems for ophthalmology or surgery may incorporate components listed in FSTEC control schedules.
From December 1, 2025, an additional risk emerged. Government Decree No. 1958 dated November 29, 2025 (hereinafter — GD No. 1958) added eight electro-optical materials to Annex 3 of GD No. 313, prohibiting their export to unfriendly states: lithium niobate (LiNbO₃), zinc telluride (ZnTe), gadolinium gallium garnet, gallium arsenide (GaAs), gallium phosphide, processed and unprocessed quartz wafers, and polished tellurium oxide prisms. According to the explanatory note, all eight materials are in demand for military electro-optical equipment, including guidance systems and night-vision devices.
The precise scope of this regulation matters: GD No. 1958 bans the export of the listed materials to unfriendly states. It is not a ban on importing equipment that contains these components. For suppliers and service organizations with bidirectional logistics flows — importing equipment and later exporting it for repair or maintenance — the presence of these materials in a device creates a direct restriction on the return leg.
When Things Got Simpler
Against the backdrop of tightening rules, there is a mechanism introduced as early as January 2025 that is worth knowing. Order of FSTEC of Russia No. 17 dated January 20, 2025 (hereinafter — Order No. 17) approved an updated list of goods to which export-control restrictions do not apply on export. Paragraph 2.32 explicitly lists HS Group 90: «Instruments and apparatus… medical or surgical.»
Before Order No. 17, sending a broken MRI coil abroad for factory repair was a separate procedure requiring FSTEC licensing. For goods in Group 90, that process is now significantly simpler: standard export-control prohibitions do not apply on export. Service companies and distributors have gained a practical tool for reducing operational overhead.
Two limitations apply. Order No. 17 covers exports only — it has no bearing on bringing equipment into Russia. And if a device contains materials from GD No. 1958 and is being exported to an unfriendly state, the exception under Order No. 17 and the prohibition under GD No. 1958 may conflict. This should be reviewed with a legal expert well in advance.
Export Restrictions: Regime Extended to 2027
Government Decrees No. 311 and No. 312 dated March 9, 2022 established, respectively, a temporary ban on exporting a range of medical goods and a permit-based procedure for exports to EAEU member states. Both decrees have been extended until December 31, 2027.
Roszdravnadzor is authorized to issue export permits for MDs included in the schedule attached to GD No. 312. The permit procedure is defined by Order of Roszdravnadzor No. 39 dated January 15, 2024. The application and review mechanism has not changed — only the duration of the regime has been extended.
For companies with international operations, this means the following: any export of equipment from a Russian warehouse — for demonstration, clinical trials, or servicing — requires prior verification against the schedule. If the device is listed, a Roszdravnadzor export permit is required, or, for countries outside the EAEU, compliance with GD No. 311 must be confirmed.
The Cost of a Mistake
When any regulatory layer is skipped, the matter quickly becomes an administrative offense. Current penalties under the Code of Administrative Offenses of the Russian Federation (CAO RF):
| CAO Article | Violation | Fine for Legal Entities | Confiscation |
|---|---|---|---|
| Art. 14.44, Pt. 1 | Unreliable declaration of conformity | 100,000–300,000 ₽ | No |
| Art. 14.44, Pt. 2 | Same, with threat of harm | 300,000–500,000 ₽ | No |
| Art. 16.3 | Non-compliance with restrictions (no notification or license) | 50,000–300,000 ₽ | Possible |
| Art. 16.2, Pt. 3 | Submission of invalid documents | 50,000–300,000 ₽ | Possible |
| Art. 13.6 | Use of uncertified communication equipment without a notification | 60,000–300,000 ₽ | Possible |
Fines under Art. 16.3 apply to each shipment separately: five devices without a notification generate five separate protocols. For equipment valued in the tens of millions of rubles, confiscation of a shipment is incomparably more serious than the fine itself.
Under Art. 14.44, Pt. 2, the enforcement logic is: if a manufacturer declared a device safe (no encryption functions), and an inspection reveals a Wi-Fi module, that is treated as a misleading declaration posing a potential threat to health or public safety. Financial penalties are compounded by reputational damage and possible suspension of operations.
Action Plan
Run a technical audit before submitting any documents. Request a complete description of the device’s wireless and encryption features from the manufacturer. Search the documentation for: Wi-Fi, Bluetooth, SSL, TLS, AES, HTTPS, VPN, encrypted storage. If any one feature is present, an FSB notification is required. Do not rely on verbal assurances from the supplier — some manufacturers are unaware of encryption modules embedded in composite component blocks.
Check the component composition against GD No. 1958. If the device contains laser systems, optical sensors, or semiconductor detectors, request a letter from the manufacturer listing the materials used. The presence of lithium niobate, zinc telluride, gallium arsenide, gadolinium gallium garnet, or quartz wafers is relevant to understanding export restrictions to unfriendly states. If you work exclusively with imports, this point is informational. If you plan bidirectional logistics, address it with a legal expert beforehand.
Start the notification process at least 4 weeks before the shipment date. The notification is filed by the manufacturer or its authorized representative. CLSZ FSB review takes up to 10 working days; the registry entry appears within 3 more working days. In practice, the full cycle is 3 to 4 weeks. Customs check the EEC registry — not a paper document.
Before exporting equipment from Russia, cross-check against Order No. 17. Confirm that your product falls under HS Group 90. If it does, prepare a reference to paragraph 2.32 of Order No. 17 as justification for customs. If it does not qualify for this exception, check the GD No. 312 schedule and, if necessary, obtain a Roszdravnadzor export permit in advance.
Build an internal permit matrix for your product portfolio. For each device, record three data points: whether an FSB notification exists and when it expires; whether an FSTEC conclusion or identification decision is on file; and whether the device appears in the GD No. 311/312 schedules. This is a one-time exercise that saves time and money on every subsequent shipment.
Three regulators, three documents, one shipment at customs. A registration certificate opens the market — not the border. An FSB notification and FSTEC documentation open the border. Without them, everything done before stops cold.
In 2025–2026, the regulatory environment for high-tech medical devices grew more demanding: new export bans on specific materials were introduced, the GD No. 311/312 regime was extended, and the FSTEC exceptions list was updated. Companies that have built procedures for all layers of the regulatory «matryoshka» keep operating without interruption. Those who learn about the FSB notification requirement from a customs inspector pay fines and wait.
Regulatory Framework:
1. Order of Roszdravnadzor No. 39 dated January 15, 2024 (Procedure for Issuing Export Permits for Medical Devices)
2. Decision of the Collegium of the EEC dated April 21, 2015, No. 30 «On Non-Tariff Regulation Measures» (Annex 2.19)
3. Federal Law No. 183-FZ dated July 18, 1999 «On Export Control»
4. Government Decree of the Russian Federation No. 1299 dated July 19, 2022 «On Approval of the List of Dual-Use Goods and Technologies»
5. Government Decree of the Russian Federation No. 311 dated March 9, 2022 «On the Temporary Introduction of an Export Ban on Certain Goods» (extended until December 31, 2027)
6. Government Decree of the Russian Federation No. 312 dated March 9, 2022 «On the Temporary Introduction of a Permit-Based Export Procedure for Certain Goods» (extended until December 31, 2027)
7. Government Decree of the Russian Federation No. 313 dated March 9, 2022 «On Measures Implementing Presidential Decree No. 100 dated March 8, 2022»
8. Government Decree of the Russian Federation No. 1958 dated November 29, 2025 «On Amendments to Government Decree No. 313 dated March 9, 2022»
9. Order of FSTEC of Russia No. 17 dated January 20, 2025 «On Approval of the List of Goods to Which Export Control Prohibitions and Restrictions Do Not Apply When Transferred Beyond the Borders of the Russian Federation»
10. Government Decree of the Russian Federation No. 1684 dated November 30, 2024 «On Approval of the Rules for State Registration of Medical Devices»